I've been told it's wise to use .htaccess to block users from viewing .sql files etc. Looking for advice on this. If I block user access, will this affect my admin-side ability to write to sql? If so, can I use .htaccess to provide an exception for my admin-side?

  • What language are you using which requires queries to be stored in .sql files? Usually you embed queries into your scripts rather than storing them as separate files. But in general, backend code (including SQL) should never be visible to users. – tlng05 Aug 15 '15 at 0:38
  • Just SQL and PHP (html, css). There are no queries stored in the .sql file. I just used it to set up the DB. – Claire Aug 15 '15 at 1:02
  • If those files are not needed for the site to function, I'd say you should remove them (or at least move them out of the webroot directory). Allowing SQL to be downloaded can allow an attacker to figure out how your database is structured, which then makes it much easier to craft, say, an SQL injection exploit if there is a vulnerability in your PHP. – tlng05 Aug 15 '15 at 1:05

Generally, there should never be a .sql file stored in the document root directory. There are a few reasons for this, but mainly because these files leak information about the database(s) in your environment.

Blocking users seeing those files will not inhibit your ability to perform administrative tasks on your server. However, I should stress that those files should not be present in the first place, so blocking them would not gain anything.

  • pardon my lack of knowledge, but where would be a better place to store the .sql file on my server? – Claire Aug 15 '15 at 0:12
  • What are you looking to accomplish? .sql files are only useful for admins to import the commands in to the database server. Keeping the files around on the server can be problematic because users can get access to them. – user79537 Aug 15 '15 at 0:37
  • My admin site is used for adding and removing products from a SQL db. The user site draws on these products to fill tables based on the user's search parameters. I am under the impression that I need to upload the details in my .sql file to the server. Am i wrong in assuming this? – Claire Aug 15 '15 at 0:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.